org.apache.shiro.mgt.SecurityManager Java Examples

@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    shiroFilterFactoryBean.setLoginUrl("/nowhere");

    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    Map<String, Filter> customizedFilter = new HashMap<>();  // 自定义过滤器设置 1

    customizedFilter.put("url", getURLPathMatchingFilter()); // 自定义过滤器设置 2，命名，需在设置过滤路径前

    filterChainDefinitionMap.put("/api/authentication", "authc"); // 防鸡贼登录
    filterChainDefinitionMap.put("/api/menu", "authc");
    filterChainDefinitionMap.put("/api/admin/**", "authc");

    filterChainDefinitionMap.put("/api/admin/**", "url");  // 自定义过滤器设置 3，设置过滤路径

    shiroFilterFactoryBean.setFilters(customizedFilter); // 自定义过滤器设置 4，启用
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

public static void main(String[] args) {
  //此处从ini文件来实现用用户角色权限配置，实际多从数据库表来实现
  Factory<SecurityManager> factory = new IniSecurityManagerFactory("classpath:shiro.ini.bak");

  //SercurityManager 对象
  SecurityManager instance = factory.getInstance();
  SecurityUtils.setSecurityManager(instance);

  //测试用户
  Subject currentUser = SecurityUtils.getSubject();
  UsernamePasswordToken token = new UsernamePasswordToken("admin", "admin");

  boolean result = false;
  try {
    currentUser.login(token);
    result = true;
    LOG.debug("认证成功");
  } catch (Exception e) {
    result = false;
    LOG.debug("认证失败");
  }

}
 

/**
 * ShiroFilterFactoryBean 处理拦截资源文件问题。
 *
 * @param securityManager
 * @return
 */

@Bean(name="shiroFilter")
@DependsOn({"securityManager"})
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    log.info("ShiroConfiguration.shirFilter()");
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    //拦截器.
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/captcha", "anon");
    filterChainDefinitionMap.put("/admin/code/**", "anon");
    filterChainDefinitionMap.put("admin/**/page-query", "user");
    filterChainDefinitionMap.put("/admin/employee/logout", "logout");
    filterChainDefinitionMap.put("admin/**/detail", "authc");
    shiroFilterFactoryBean.setUnauthorizedUrl("/403");
    /*shiroFilterFactoryBean.setU("/403");*/
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

    return shiroFilterFactoryBean;
}
 

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
	ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
	shiroFilterFactoryBean.setSecurityManager(securityManager);
	Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
	filterChainDefinitionMap.put("/admin/auth/login", "anon");
	filterChainDefinitionMap.put("/admin/auth/401", "anon");
	filterChainDefinitionMap.put("/admin/auth/index", "anon");
	filterChainDefinitionMap.put("/admin/auth/403", "anon");

	filterChainDefinitionMap.put("/admin/**", "authc");
	shiroFilterFactoryBean.setLoginUrl("/admin/auth/401");
	shiroFilterFactoryBean.setSuccessUrl("/admin/auth/index");
	shiroFilterFactoryBean.setUnauthorizedUrl("/admin/auth/403");
	shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
	return shiroFilterFactoryBean;
}
 

public static Session getSession(){
    try{
        SecurityManager securityManager = ThreadContext.getSecurityManager();
        if(securityManager == null){
            return null;
        }

        Subject subject = SecurityUtils.getSubject();
        Session session = subject.getSession(false);
        if (session == null){
            session = subject.getSession();
        }
        if (session != null){
            return session;
        }
    }catch (InvalidSessionException e){

    }
    return null;
}
 

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    //shirFilter
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    //拦截器.
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    // 配置不需要权限的资源
    filterChainDefinitionMap.put("/static/**", "anon");
    filterChainDefinitionMap.put("/index", "anon");
    //配置退出过滤器,退出代码Shiro已经替我们实现
    filterChainDefinitionMap.put("/logout", "logout");
    //过滤链定义，从上向下顺序执行，/**放在最下边;
    //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
    filterChainDefinitionMap.put("/**", "authc");
    // 如果不设置默认会自动寻找Web工程根目录下的"/login"页面
    shiroFilterFactoryBean.setLoginUrl("/login");
    // 登录成功后要跳转的链接
    shiroFilterFactoryBean.setSuccessUrl("/index");
    //未授权界面;
    shiroFilterFactoryBean.setUnauthorizedUrl("/403");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

/**
 * ShiroFilterFactoryBean 处理拦截资源文件问题。
 *
 * @param securityManager
 * @return
 */

@Bean(name="shiroFilter")
@DependsOn({"securityManager"})
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    log.info("ShiroConfiguration.shirFilter()");
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    //拦截器.
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();
    filterChainDefinitionMap.put("/captcha", "anon");
    filterChainDefinitionMap.put("/admin/code/**", "anon");
    filterChainDefinitionMap.put("admin/**/page-query", "user");
    filterChainDefinitionMap.put("/admin/employee/logout", "logout");
    filterChainDefinitionMap.put("admin/**/detail", "authc");
    shiroFilterFactoryBean.setUnauthorizedUrl("/403");
    /*shiroFilterFactoryBean.setU("/403");*/
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);

    return shiroFilterFactoryBean;
}
 

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<String, String>();
    filterChainDefinitionMap.put("/admin/auth/login", "anon");
    filterChainDefinitionMap.put("/admin/auth/401", "anon");
    filterChainDefinitionMap.put("/admin/auth/index", "anon");
    filterChainDefinitionMap.put("/admin/auth/403", "anon");

    filterChainDefinitionMap.put("/admin/**", "authc");
    shiroFilterFactoryBean.setLoginUrl("/admin/auth/401");
    shiroFilterFactoryBean.setSuccessUrl("/admin/auth/index");
    shiroFilterFactoryBean.setUnauthorizedUrl("/admin/auth/403");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

/**
 * Filter工厂，设置过滤条件与跳转条件
 */
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
    ShiroFilterFactoryBean bean = new ShiroFilterFactoryBean();

    // Shiro的核心安全接口
    bean.setSecurityManager(securityManager);

    // 设置登陆页
    bean.setLoginUrl("/login");

    // 自定义拦截规则
    Map<String,String> map = new HashMap<>(16);
    map.put("/", "anon");
    // 设置退出登陆
    map.put("/logout", "logout");
    // 对所有用户认证
    map.put("/**", "authc");

    bean.setFilterChainDefinitionMap(map);
    return bean;
}
 

/**
 * ShiroFilterFactoryBean 处理拦截资源文件问题。
 * 注意：单独一个ShiroFilterFactoryBean配置是或报错的，因为在
 * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
 * Filter Chain定义说明
 * 1、一个URL可以配置多个Filter，使用逗号分隔
 * 2、当设置多个过滤器时，全部验证通过，才视为通过
 * 3、部分过滤器可指定参数，如perms，roles
 */
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    // 必须设置 SecurityManager
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    shiroFilterFactoryBean.setLoginUrl("/passport/login/");
    // 登录成功后要跳转的链接
    shiroFilterFactoryBean.setSuccessUrl("/index");
    // 未授权界面;
    shiroFilterFactoryBean.setUnauthorizedUrl("/error/403");
    // 配置数据库中的resource
    Map<String, String> filterChainDefinitionMap = shiroService.loadFilterChainDefinitions();
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    //拦截器.
    Map<String,String> filterChainDefinitionMap = new LinkedHashMap<>();
    // 配置不会被拦截的链接 顺序判断
    filterChainDefinitionMap.put("/static/**", "anon");
    filterChainDefinitionMap.put("/upload/**", "anon");
    filterChainDefinitionMap.put("/plugins/**", "anon");
    filterChainDefinitionMap.put("/templates/**", "anon");
    filterChainDefinitionMap.put("/admin/code/api/generate", "anon");
    filterChainDefinitionMap.put("/admin/login/api/toLogin", "anon");
    filterChainDefinitionMap.put("/admin/login/api/loginCheck", "anon");
    filterChainDefinitionMap.put("/**", "authc");

    shiroFilterFactoryBean.setLoginUrl("/admin/login/api/toLogin");
    shiroFilterFactoryBean.setSuccessUrl("/admin/login/api/toIndex");
    shiroFilterFactoryBean.setUnauthorizedUrl("/admin/login/api/toIndex");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

@Override
protected AbstractShiroFilter createInstance() throws Exception {
    LOGGER.debug("Creating Shiro Filter instance.");
    SecurityManager securityManager = this.getSecurityManager();
    String msg;
    if (securityManager == null) {
        msg = "SecurityManager property must be set.";
        throw new BeanInitializationException(msg);
    } else if (!(securityManager instanceof WebSecurityManager)) {
        msg = "The security manager does not implement the WebSecurityManager interface.";
        throw new BeanInitializationException(msg);
    } else {
        FilterChainManager manager = this.createFilterChainManager();
        RestPathMatchingFilterChainResolver chainResolver = new RestPathMatchingFilterChainResolver();
        chainResolver.setFilterChainManager(manager);
        return new RestShiroFilterFactoryBean.SpringShiroFilter((WebSecurityManager)securityManager, chainResolver);
    }
}
 

@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
	System.out.println("ShiroConfiguration.shirFilter()");
	ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
	shiroFilterFactoryBean.setSecurityManager(securityManager);
	//拦截器.
	Map<String,String> filterChainDefinitionMap = new LinkedHashMap<String,String>();
	// 配置不会被拦截的链接 顺序判断
	filterChainDefinitionMap.put("/static/**", "anon");
	//配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了
	filterChainDefinitionMap.put("/logout", "logout");
	//<!-- 过滤链定义，从上向下顺序执行，一般将/**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
	//<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
	filterChainDefinitionMap.put("/**", "authc");
	// 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
	shiroFilterFactoryBean.setLoginUrl("/login");
	// 登录成功后要跳转的链接
	shiroFilterFactoryBean.setSuccessUrl("/index");

	//未授权界面;
	shiroFilterFactoryBean.setUnauthorizedUrl("/403");
	shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
	return shiroFilterFactoryBean;
}
 

@Bean
public ShiroFilterFactoryBean shiroFilter(SecurityManager securityManager){
    log.info("Shiro Configuration initialized");
    ShiroFilterFactoryBean shiroFilterFactoryBean  = new ShiroFilterFactoryBean();

    //设置SecurityManager
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    //拦截器
    //<!-- 过滤链定义，从上向下顺序执行，一般将 /**放在最为下边 -->:这是一个坑呢，一不小心代码就不好使了;
    //<!-- authc:所有url都必须认证通过才可以访问; anon:所有url都都可以匿名访问-->
    Map<String,String> filterChainDefinitionMap = shiroService.getFilterChainDefinitionMap();

    //过滤器
    Map<String,Filter> filters = new HashMap<>();
    filters.put("perms",new JwtFilter());
    shiroFilterFactoryBean.setFilters(filters);
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

/**
 * ShiroFilterFactoryBean 处理拦截资源文件问题。
 * 注意：单独一个ShiroFilterFactoryBean配置是或报错的，因为在
 * 初始化ShiroFilterFactoryBean的时候需要注入：SecurityManager
 * Filter Chain定义说明
 * 1、一个URL可以配置多个Filter，使用逗号分隔
 * 2、当设置多个过滤器时，全部验证通过，才视为通过
 * 3、部分过滤器可指定参数，如perms，roles
 */
@Bean(name = "shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    // 必须设置 SecurityManager
    shiroFilterFactoryBean.setSecurityManager(securityManager);
    // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    shiroFilterFactoryBean.setLoginUrl(shiroProperties.getLoginUrl());
    // 登录成功后要跳转的链接
    shiroFilterFactoryBean.setSuccessUrl(shiroProperties.getSuccessUrl());
    // 未授权界面;
    shiroFilterFactoryBean.setUnauthorizedUrl(shiroProperties.getUnauthorizedUrl());
    // 配置数据库中的resource
    Map<String, String> filterChainDefinitionMap = shiroService.loadFilterChainDefinitions();
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

@Override
protected AbstractShiroFilter createInstance() throws Exception {
	SecurityManager securityManager = getSecurityManager();
	if (securityManager == null){
		throw new BeanInitializationException("SecurityManager property must be set.");
	}

	if (!(securityManager instanceof WebSecurityManager)){
		throw new BeanInitializationException("The security manager does not implement the WebSecurityManager interface.");
	}

	PathMatchingFilterChainResolver chainResolver = new PathMatchingFilterChainResolver();
	FilterChainManager chainManager = createFilterChainManager();
	chainResolver.setFilterChainManager(chainManager);
	return new MySpringShiroFilter((WebSecurityManager)securityManager, chainResolver);
}
 

ShiroAuthProvider(AuthConfig authConfig,
                  Ini config,
                  Supplier<String> sessionIdGenerator,
                  Function<Session, CompletableFuture<Void>> loginSessionPropagator,
                  Function<String, CompletableFuture<Void>> logoutSessionPropagator) {
    requireNonNull(authConfig, "authConfig");
    requireNonNull(config, "config");
    requireNonNull(sessionIdGenerator, "sessionIdGenerator");
    requireNonNull(loginSessionPropagator, "loginSessionPropagator");
    requireNonNull(logoutSessionPropagator, "logoutSessionPropagator");

    final SecurityManager securityManager = createSecurityManager(config, sessionIdGenerator);
    final Duration sessionValidDuration = Duration.ofMillis(authConfig.sessionTimeoutMillis());

    loginApiService = new LoginService(securityManager, authConfig.loginNameNormalizer(),
                                       loginSessionPropagator, sessionValidDuration);
    logoutApiService = new LogoutService(securityManager, logoutSessionPropagator);
}
 

private static SecurityManager createSecurityManager(Ini config, Supplier<String> sessionIdGenerator) {
    final Factory<SecurityManager> factory = new IniSecurityManagerFactory(config) {
        @Override
        protected SecurityManager createDefaultInstance() {
            final DefaultSessionManager sessionManager = new DefaultSessionManager();
            // This session DAO is required to cache the session in a very short time, especially while
            // logging in to the Central Dogma server. After that, the general session manager provided
            // by Central Dogma server will be working for the session management.
            sessionManager.setSessionDAO(new LimitedMemorySessionDAO(sessionIdGenerator,
                                                                     64, Duration.ofHours(1)));

            final DefaultSecurityManager securityManager = new DefaultSecurityManager();
            securityManager.setSessionManager(sessionManager);

            return securityManager;
        }
    };
    return factory.getInstance();
}
 

/**
 * Filter工厂，设置对应的过滤条件和跳转条件
 * create by: leigq
 * create time: 2019/7/3 14:29
 *
 * @return ShiroFilterFactoryBean
 */
@Bean
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {

    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    // 过滤器链定义映射
    Map<String, String> filterChainDefinitionMap = new LinkedHashMap<>();

    /*
     * anon:所有url都都可以匿名访问，authc:所有url都必须认证通过才可以访问;
     * 过滤链定义，从上向下顺序执行，authc 应放在 anon 下面
     * */
    filterChainDefinitionMap.put("/login", "anon");
    // 配置不会被拦截的链接 顺序判断，因为前端模板采用了thymeleaf，这里不能直接使用 ("/static/**", "anon")来配置匿名访问，必须配置到每个静态目录
    filterChainDefinitionMap.put("/css/**", "anon");
    filterChainDefinitionMap.put("/fonts/**", "anon");
    filterChainDefinitionMap.put("/img/**", "anon");
    filterChainDefinitionMap.put("/js/**", "anon");
    filterChainDefinitionMap.put("/html/**", "anon");
    // 所有url都必须认证通过才可以访问
    filterChainDefinitionMap.put("/**", "authc");

    // 配置退出 过滤器,其中的具体的退出代码Shiro已经替我们实现了, 位置放在 anon、authc下面
    filterChainDefinitionMap.put("/logout", "logout");

    // 如果不设置默认会自动寻找Web工程根目录下的"/login.jsp"页面
    // 配器shirot认登录累面地址，前后端分离中登录累面跳转应由前端路由控制，后台仅返回json数据, 对应LoginController中unauth请求
    shiroFilterFactoryBean.setLoginUrl("/un_auth");

    // 登录成功后要跳转的链接, 此项目是前后端分离，故此行注释掉，登录成功之后返回用户基本信息及token给前端
    // shiroFilterFactoryBean.setSuccessUrl("/index");

    // 未授权界面, 对应LoginController中 unauthorized 请求
    shiroFilterFactoryBean.setUnauthorizedUrl("/unauthorized");
    shiroFilterFactoryBean.setFilterChainDefinitionMap(filterChainDefinitionMap);
    return shiroFilterFactoryBean;
}
 

@Bean
public ShiroFilterFactoryBean shiroFilter(@Qualifier("securityManager") SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilterFactoryBean = new ShiroFilterFactoryBean();

    // 必须设置 SecurityManager
    shiroFilterFactoryBean.setSecurityManager(securityManager);

    return shiroFilterFactoryBean;
}
 

/**
 * 修复UnavailableSecurityManagerException（详见issues#IK7C3）
 *
 * @param securityManager
 * @return
 */
@Bean
public MethodInvokingFactoryBean methodInvokingFactoryBean(SecurityManager securityManager) {
    MethodInvokingFactoryBean bean = new MethodInvokingFactoryBean();
    bean.setStaticMethod("org.apache.shiro.SecurityUtils.setSecurityManager");
    bean.setArguments(securityManager);
    return bean;
}
 

@Bean(name = "shiroFilter")
@DependsOn("securityManager")
@ConditionalOnMissingBean
public FilterRegistrationBean filterRegistrationBean(SecurityManager securityManager) throws Exception {
    FilterRegistrationBean filterRegistration = new FilterRegistrationBean();
    //该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理
    filterRegistration.addInitParameter("targetFilterLifecycle", "true");
    filterRegistration.setFilter((Filter) getShiroFilterFactoryBean(securityManager).getObject());
    filterRegistration.setEnabled(true);
    filterRegistration.addUrlPatterns("/*");
    return filterRegistration;
}
 

@Bean("shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);

    //oauth过滤
    Map<String, Filter> filters = new HashMap<>();
    filters.put("oauth2", new OAuth2Filter());
    shiroFilter.setFilters(filters);

    Map<String, String> filterMap = new LinkedHashMap<>();
    filterMap.put("/test/**", "anon");
    filterMap.put("/actuator/**", "anon");
    filterMap.put("/pay/**", "anon");
    filterMap.put("/webjars/**", "anon");
    filterMap.put("/druid/**", "anon");
    filterMap.put("/app/**", "anon");
    filterMap.put("/file/**", "anon");
    filterMap.put("/wechat/**", "anon");
    filterMap.put("/UEditor/**", "anon");
    filterMap.put("/sys/login", "anon");
    filterMap.put("/sys/logistics/**", "anon");
    filterMap.put("/swagger/**", "anon");
    filterMap.put("/wx/**", "anon");
    filterMap.put("/v2/api-docs", "anon");
    filterMap.put("/swagger-ui.html", "anon");
    filterMap.put("/swagger-resources/**", "anon");
    filterMap.put("/captcha.jpg", "anon");
    filterMap.put("/**", "oauth2");
    shiroFilter.setFilterChainDefinitionMap(filterMap);

    return shiroFilter;
}
 

@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(@Qualifier("authRealm")AuthRealm authRealm) {
    SecurityManager manager= securityManager(authRealm);
    AuthorizationAttributeSourceAdvisor advisor=new AuthorizationAttributeSourceAdvisor();
    advisor.setSecurityManager(manager);
    return advisor;
}
 

@Bean
public SecurityManager securityManager(@Qualifier("authRealm")AuthRealm authRealm){
    logger.info("- - - - - - -shiro开始加载- - - - - - ");
    DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
    defaultWebSecurityManager.setRealm(authRealm);
    defaultWebSecurityManager.setRememberMeManager(rememberMeManager());
    defaultWebSecurityManager.setSessionManager(webSessionManager());
    defaultWebSecurityManager.setCacheManager(cacheManager());
    return defaultWebSecurityManager;
}
 

@Bean
public MethodInvokingFactoryBean methodInvokingFactoryBean(SecurityManager securityManager){
    MethodInvokingFactoryBean bean = new MethodInvokingFactoryBean();
    bean.setStaticMethod("org.apache.shiro.SecurityUtils.setSecurityManager");
    bean.setArguments(securityManager);
    return bean;
}
 

@Bean
public SecurityManager securityManager(RedisCacheManager RedisCacheManager){
    DefaultWebSecurityManager manager =  new DefaultWebSecurityManager();
    manager.setRealm(myRealm());
    manager.setCacheManager(RedisCacheManager);
    /*
    * 关闭session存储，禁用Session作为存储策略的实现，
    * 但它没有完全地禁用Session所以需要配合SubjectFactory中的context.setSessionCreationEnabled(false)
    */
    //manager.setSessionManager(sessionManager());
    ((DefaultSessionStorageEvaluator) ((DefaultSubjectDAO)manager.getSubjectDAO())
            .getSessionStorageEvaluator()).setSessionStorageEnabled(false);
    manager.setSubjectFactory(new AgileSubjectFactory());
    return manager;
}
 

public ShiroFilterFactoryBean getShiroFilterFactoryBean(SecurityManager securityManager) throws Exception {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);
    shiroFilter.setLoginUrl(shiroProperties.getLoginUrl());
    shiroFilter.setSuccessUrl(shiroProperties.getSuccessUrl());
    shiroFilter.setUnauthorizedUrl(shiroProperties.getUnauthorizedUrl());

    Map<String, Filter> filterMap = new LinkedHashMap<String, Filter>();
    filterMap.put("authm", authFilter());

    Map<String, Filter> filterClasses = instantiateFilterClasses(shiroProperties.getFilters());
    if (filterClasses != null) {
        filterMap.putAll(filterClasses);
    }

    if (shiroFilterCustomizer != null) {
        filterMap = shiroFilterCustomizer.customize(filterMap);
    }

    shiroFilter.setFilters(filterMap);

    Map<String, String> filterChains = new LinkedHashMap<String, String>();
    if (jdbcPermissionDefinitionsLoader != null) {
        Map<String, String> permissionUrlMap = jdbcPermissionDefinitionsLoader.getObject();
        filterChains.putAll(permissionUrlMap);
    }
    if (shiroProperties.getFilterChainDefinitions() != null) {
        filterChains.putAll(shiroProperties.getFilterChainDefinitions());
    }
    shiroFilter.setFilterChainDefinitionMap(filterChains);

    return shiroFilter;
}
 

@Bean("shiroFilter")
public ShiroFilterFactoryBean shirFilter(SecurityManager securityManager) {
    ShiroFilterFactoryBean shiroFilter = new ShiroFilterFactoryBean();
    shiroFilter.setSecurityManager(securityManager);

    //过滤
    Map<String, Filter> filters = new HashMap<>();
    filters.put("shiro", new ShiroAuthenticatingFilter());
    shiroFilter.setFilters(filters);

    Map<String, String> filterMap = new LinkedHashMap<>();
    filterMap.put("/api/**", "anon");
    filterMap.put("/druid/**", "anon");
    filterMap.put("/sys/login", "anon");
    filterMap.put("/sys/doGetKaptchaOnOff", "anon");
    filterMap.put("/**/*.css", "anon");
    filterMap.put("/**/*.js", "anon");
    filterMap.put("/**/*.html", "anon");
    filterMap.put("/fonts/**", "anon");
    filterMap.put("/plugins/**", "anon");
    filterMap.put("/favicon.ico", "anon");
    filterMap.put("/captcha.jpg", "anon");
    filterMap.put("/image/**", "anon");
    filterMap.put("/uploadFile/**", "anon");//上传文件映射的地址
    filterMap.put("/", "anon");
    filterMap.put("/**", "shiro");
    shiroFilter.setFilterChainDefinitionMap(filterMap);

    return shiroFilter;
}
 

@Bean(name = "shiroFilter")
@DependsOn("securityManager")
@ConditionalOnMissingBean
public FilterRegistrationBean filterRegistrationBean(SecurityManager securityManager) throws Exception {
    FilterRegistrationBean filterRegistration = new FilterRegistrationBean();
    //该值缺省为false,表示生命周期由SpringApplicationContext管理,设置为true则表示由ServletContainer管理
    filterRegistration.addInitParameter("targetFilterLifecycle", "true");
    filterRegistration.setFilter((Filter) getShiroFilterFactoryBean(securityManager).getObject());
    filterRegistration.setEnabled(true);
    filterRegistration.addUrlPatterns("/*");

    return filterRegistration;
}